www.Inmagic.com    Inmagic Forums    Inmagic Forums  Hop To Forum Categories  Bug Reports    Aparent buffer overflow in WP4.01
Go
New
Find
Notify
Tools
Reply
  
-star Rating Rate It!  Login/Join 
Posted
Hi People,

First up, yes, we're still using WP4.01 because the bugs I found in WP4.1 and the extent of the changes to our existing reports has held us off from upgrading. I understand we are now looking at TW & WP v5.x

I have a canned query that picks up recently modified records and displays them in a tabulated brief report.

This tabulated report then has checkboxes so that you can view each (selected) record in more detail, individually. Using the Next and Previous buttons to step through.

However, recently we've started getting a JavaScript error in the detailed individual report. I'm not sure when this started happening, as it's only just been reported to me.

I've tried simulating a real query that returns the same records (not based on recently modified field), but that works perfectly.

What I've noticed is that in the header of the detailed report, the query string is being handled differently.

Here's the results of my "real" query (note the URL encoding of the beginning):
BU=https%3A%2F%2Ffidelis.chapmantripp.co.nz%2Fdbtw-wpd%2Fexec%2Fdbtwpcgi.exe&RF=TrippwirePrint&QB1=OR&QF1=Opinion+No&QI1=4686&QB2=OR&QF2=Opinion+No&QI2=4826&TN=transfund&MR=1&NP=3& RL=0&DL=0&AC=QBE_QUERY&DF=TrippwirePrint

And here's the result from my canned query (note the URL encoding of most of the query string):
BU=https%3A%2F%2Ffidelis.chapmantripp.co.nz%2Fdbtw-wpd%2Fexec%2Fdbtwpcgi.exe%3FXC%3D%2Fdbtw-wpd%2Fexec%2Fdbtwpcgi.exe%26BU%3Dhttps%3A%2F%2Ffidelis.chapmantripp.co.nz%2Fclients%2F12 637%2Fnew.asp%26TN%3DTransfund%26DF%3DTrippwirePrint%26RF%3DTrippwireTable%26AC%3DQBE_QUERY%26QB1%3DAND%26QF1%3DDate%2BRecord%2BCreated%2B%257C%2BDate%2BLast%2BModified%26QI1%3D%25 3E%253D2%252DSep%252D2001%26womble%3Dtest&RF=TrippwirePrint&QB1=OR&QF1=Opinion+No&QI1=4686&QB2=OR&QF2=Opinion+No&QI2=4826&TN=transfund&MR=1&NP=3&RL=0&DL=0&AC=QBE_QUERY&DF=Trippwire Print

(Yes, the womble=test is a marker of mine)

This leads the problem. The detailed report is failing the in the dbtw_initialise() call because from out of no-where the physical path to the DB is inserted and because it's not escaped, JavaScript throws a wobbly at the \ characters.

Here's the good one:
dbtw_initialize("https://fidelis.chapmantripp.co.nz/dbtw-wpd/exec/dbtwpcgi.exe","transfund","AUTO10976",97,0,1,"TrippwirePrint","TrippwirePrint",0,0,3,"","/dbtw-wpd/images/","/dbtw -wpd/images/");

Here's the bad one:
dbtw_initialize("https://fidelis.chapmantripp.co.nz/dbtw-wpd/exec/dbtwpcgi.exe?XC=/dbtw-wpd/exec/dbtwpcgi.exe&BU=https://fidelis.chapmantripp.co.nz/clients/12637/new.asp&TN=Transfu nd&DF=TrippwirePrint&RF=TrippwireTable&AC=QBE_QUERY&QB1=AND&QF1=Date+Record+Created+%7C+Date+LastE:\TextBases\12637\","transfund","AUTO17387",111,0,1,"TrippwirePrint","TrippwirePri nt",0,0,3,"","/dbtw-wpd/images/","/dbtw-wpd/images/");

See the E:\TextBases\12637\ that appears to have truncated the old querystring, leading me to believe there's some kind of buffer overflow, even though I'm sure I've had longer query strings than that.

Any ideas?

Later'ish
Craig

[This message has been edited by CraigHumphrey (edited 02 October 2001).]
 
Posts: 142 | Location: Auckland, New Zealand | Registered: Thu August 10 2000Reply With QuoteEdit or Delete MessageReport This Post
  Powered by Eve Community  
 

www.Inmagic.com    Inmagic Forums    Inmagic Forums  Hop To Forum Categories  Bug Reports    Aparent buffer overflow in WP4.01